Turns out doesn’t understand and packagist, and using their packages from their server can cause serious errors. They don’t correctly specify all their packages’ dependencies, and they do publish breaking changes under patch (x.x.0) releases.